Skip to content

Commit

Permalink
Add EDR agent ID discovery rule
Browse files Browse the repository at this point in the history
  • Loading branch information
Charles Ngor committed Sep 20, 2024
1 parent 686a1bc commit 9b06104
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions docs/xdr/features/collect/assets.md
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,13 @@ The following table lists the atom types and their related event fields that are

This rule enriches an existing asset with an `os` contextual property. This property is extracted from the value of all the `os` related fields of an event where its `host.name` field matches the `hostname` detection property of the asset. In addition, this rule categorizes the asset as a Server if the `host.type` contains `server`.

### Attach EDR agent IDs to Host

**Set the Contextual Property `edr_agent_id` to Host**

This rule enriches an existing asset with the `edr_agent_id` contextual property (for example `sentinelone_agent_id`). This property is extracted from the values of `agent.id` and `agent.type`. This rule only applies to assets of `Host` category.

Note that a single host can have multiple EDR agent IDs.

### Discover unique Hosts

Expand Down

0 comments on commit 9b06104

Please sign in to comment.